Every SSL listener requires a paired SSL private key and SSL certificate. Multiple SSL listeners can share the same key and certificate.

You can generate SSL private keys yourself using an SSL software package, such as OpenSSL. SSL certificates can also be purchased from an authorized certificate issuer like VeriSign or Thawte. You can also sign the certificate yourself. Self-signed certificates will not be trusted by web browsers and should not be used on public websites containing critical data. However, a self-signed certificate is good enough for internal use, e.g. for encrypting traffic to LiteSpeed Web Server's WebAdmin Console.

Private Key File

Description

The filename of the SSL private key file. The key file should not be encrypted.

Syntax

Filename which can be an absolute path or a relative path to $SERVER_ROOT.

Tips

[Security] The private key file should be placed in a secured directory that allows read-only access to the user the server runs as.

Certificate File

Description

The filename of the SSL certificate file.

Syntax

Filename which can be an absolute path or a relative path to $SERVER_ROOT.

Tips

[Security] The certificate file should be placed in a secured directory, which allows read-only access to the user that the server runs as.

Chained Certificate

Description

Specifies whether the certificate is a chained certificate or not. The file that stores a certificate chain must be in PEM format, and the certificates must be in the chained order, from the lowest level (the actual client or server certificate) to the highest level (root) CA.

Syntax

Select from radio box

CA Certificate Path

Description

Specifies the directory where the certificates of certification authorities (CAs) are kept. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.

Syntax

path

CA Certificate File

Description

Specifies the file that contains all certificates of certification authorities (CAs) for chained certificates. This file is simply the concatenation of PEM-encoded certificate files, in order of preference. This can be used as an alternative or in addition to CA Certificate Path. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.

Syntax

Filename which can be an absolute path or a relative path to $SERVER_ROOT.

SSL Protocol

Description

Customizes SSL protocols accepted by the listener.

Protocol Version

Description

Specifies which version of the SSL protocol will be used. You can choose from SSL v3.0 and TLS v1.0. Since OpenSSL 1.0.1, TLS v1.1 and TLS v1.2 are also supported.

Tips

Leaving this field blank will enable TLS v1.0, TLS v1.1, and TLS v1.2 by default.

Ciphers

Description

Specifies the cipher suite to be used when negotiating the SSL handshake. LSWS supports cipher suites implemented in SSL v3.0, TLS v1.0, and TLS v1.2.

Syntax

Colon-separated string of cipher specifications.

Example

ECDHE-RSA-AES128-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Tips

[Security] We recommend leaving this field blank to use our default cipher which follows SSL cipher best practices.

Enable ECDH Key Exchange

Description

Allows use of Elliptic Curve Diffie-Hellman key exchange for further SSL encryption.

Syntax

Select from radio box

Tips

[Security] ECDH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure.

[Performance] Enabling ECDH key exchange will increase CPU load and is slower than using just an RSA key.

Enable DH Key Exchange

Description

Allows use of Diffie-Hellman key exchange for further SSL encryption.

Syntax

Select from radio box

Tips

[Security] DH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure.

Check the protocol(s) you wish to enable. Leaving all boxes unchecked will enable SPDY and HTTP/2 support (the default). If you wish to disable SPDY and HTTP/2, check "None" only and leave all other boxes unchecked.

Client Verification

Description

Specifies the type of client certifcate authentication. Available types are:

None: No client certificate is required.

Optional: Client certificate is optional.

Require: The client must has valid certificate.

Optional_no_ca: Same as optional.

The default is "None".

Syntax

Select from drop down list

Tips

"None" or "Require" are recommended.

Verify Depth

Description

Specifies how deeply a certificate should be verified before determining that the client does not have a valid certificate. The default is "1".

Syntax

Select from drop down list

Client Revocation Path

Description

Specifies the directory containing PEM-encoded CA CRL files for revoked client certificates. The files in this directory have to be PEM-encoded. These files are accessed through hash filenames, hash-value.rN. Please refer to openSSL or Apache mod_ssl documentation regarding creating the hash filename.

Syntax

path

Client Revocation File

Description

Specifies the file containing PEM-encoded CA CRL files enumerating revoked client certificates. This can be used as an alternative or in addition to Client Revocation Path.

Syntax

Filename which can be an absolute path or a relative path to $SERVER_ROOT.